ROS-2-1481

2.1481 Multiple vulnerabilities in libwebp 1. Vulnerability Description: CVE-2020-36332 A vulnerability in the libwebp library for encoding and decoding WebP images, is related to improper control of internal resource consumption. Exploitation of the vulnerability could allow an attacker acting...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to cURL libcurl denial of service vulnerability( CVE-2023-23916)

Summary Potential cURL libcurl denial of service vulnerability CVE-2023-23916 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-23916 DESCRIPTION: cURL libcurl is vulnerable to a...

Bouncy Castle For Java LDAP injection vulnerability

Bouncy Castle provides the X509LDAPCertStoreSpi.java class which can be used in conjunction with the CertPath API for validating certificate paths. Pre-1.73 the implementation did not check the X.500 name of any certificate, subject, or issuer being passed in for LDAP wild cards, meaning the...

The vulnerability of the Setting Handler component of the Elcomplus SmartPPT server allows a perpetrator to execute arbitrary code.

The vulnerability of the Setting Handler component in the Elcomplus SmartPPT server is related to authentication errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2020-36737

The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the astraadminerrors function. This makes it possible for unauthenticated attackers to display ...

PT-2023-11877 · WordPress · Import / Export Customizer Settings

Name of the Vulnerable Software and Affected Versions: Import / Export Customizer Settings plugin for WordPress versions up to, and including, 1.0.3 Description: The issue is due to missing or incorrect nonce validation on the astra admin errors function, making it possible for unauthenticated...

The vulnerabilities in the configuration of FortiClient installer distributions and the FortiConverter migration service allow a hacker to replace files in the software installation directory.

The vulnerability of the Fortinet FortiClient installer and the FortiConverter configuration and policy transfer tool is related to errors in the use of standard permissions. Exploiting this vulnerability could allow an attacker to replace files in the software installation directory...

spring-boot: Spring Boot Welcome Page DoS Vulnerability

A flaw was found in Spring Boot, occurring prominently in Spring MVC with a reverse proxy cache. This issue requires Spring MVC to have auto-configuration enabled and the application to use Spring Boot's welcome page support, either static or templated, resulting in the application being deployed...

The vulnerability of the Hotspot component in the Java SE software platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Java SE software platform’s hotspot component is related to security configuration errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a security vulnerability that stems from incorrect input validation, which could result in out-of-bounds reads, which could lead to local information leaks...

The vulnerability of the Windows command-line interpreter allows a hacker to execute arbitrary code.

The vulnerability of the Windows command-line interpreter arises from the lack of mechanisms to stop the execution of a script after an error is detected in it. Exploiting this vulnerability allows an attacker to execute arbitrary code by creating images using the built-in graphics editor MS Pain...

The vulnerability of the corporate VPN application GlobalProtect Agent, related to errors in processing input data, allows a hacker to execute arbitrary commands with elevated privileges.

The vulnerability of the corporate VPN application GlobalProtect Agent is related to errors in processing input data. Exploiting this vulnerability allows an attacker to execute arbitrary commands with elevated privileges...

PT-2023-4398 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux Kernel ksmbd affected versions not specified Description: The issue is related to errors in pointer dereferencing in the ksmbd module of the Linux operating system kernel. Exploitation of this issue may allow a remote attacker to cause ...

Vulnerability of FortiOS operating systems and FortiProxy proxy servers in protecting against Internet attacks, related to errors in the certificate validation process, allowing attackers to execute “man-in-the-middle” type attacks.

The vulnerability of the FortiOS operating systems and the FortiProxy proxy server for protection against Internet attacks is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to execute a “man-in-the-middle” attack remotely...

Missing store revert in case of swap error can lead to loss of funds

Lines of code Vulnerability details Impact The module is expected to have no state changes in case a swap failed, and continue to the conversion phase. It was implemented by swallowing the error with a log and continuing with the flow erc20 conversion, etc. This is the relevant code section:...

The vulnerability of the Windows GDI component of the Windows operating system, which allows attackers to escalate their privileges

The vulnerability of the Windows GDI component of the Windows operating system is related to errors in privilege management. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Web page rendering module in the WebKit browser of Apple’s operating systems macOS, iOS, iPadOS allows a hacker to execute arbitrary code.

The vulnerability of the Web page rendering module in WebKit of Apple Safari browsers for operating systems macOS, iOS, iPadOS is related to type conversion errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2023-3652 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 versions 2 Description: The issue is related to errors in resource release, which can be exploited to cause a denial of service. A malicious user can potentially exploit this issue remotely, leading to a crash of the ROS2 nodes...

ROS-20230622-08

Mozilla Thunderbird email client vulnerability is related to a boundary error in FileReader::DoReadData when reading a file. Exploitation of the vulnerability could allow an attacker acting remotely to cause memory corruption and execute arbitrary code on the target system. memory corruption and...

The vulnerability of the Routing Protocol Demon (rpd) in Juniper Networks’ Junos OS and Junos OS Evolved operating systems allows a attacker to cause a service failure.

The vulnerability of the Routing Protocol Demon rpd in Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to memory release errors, as well as unlimited resource allocation. Exploiting this vulnerability can allow an attacker to trigger a service failure by executing a...